So when a Sandbox is refreshed or created, everyone's email gets changed so that it has .invalid on the end.

This seems to have the useful side effect of stopping users from logging in - when they first try to access the sandbox, Salesforce tries to email them a verification code and they can't get the email, so they can't log in until and admin corrects their email address.

In terms of sandbox security (particularly full copy sandboxes) this seems quite useful.

My question is: Is this a hard and fast rule that I can rely on - that users wont be able to log into a fresh sandbox unless someone fixes their email address - or are there some situations when a verification code is not required and hence users can get straight into a sandbox.

In short, I need to know if this is an 'official' feature or just some happy accident that depends on other security settings around verification codes. I'm writing something about sandbox security and need to know how reliable this is ....

  • 1
    Hmm, in case if there are certain set of IP address which is whitelisted for certain profile, then user will be able to login with his sandbox username and production password WITHOUT Verification code required.
    – kurunve
    Commented Jun 25, 2019 at 22:21

1 Answer 1


You should assume that any given user will have a decent chance of logging in unless they are frozen/disabled/intentionally locked out via a script. If the user has a production password, and they know what it was at the time of creation/refresh, they can use that password. From there, if they've logged in from that IP address recently, they often won't be challenged; alternatively, if they are coming from a whitelisted IP or an IP within their Login IP Restriction settings, they won't be challenged. Even if they are challenged, if they have set up mobile/SMS verification, they can still use that method to log in. Unless an administrator takes active steps to prevent users from logging in, there's no reason to believe that users cannot log in as long as they meet certain criteria.

  • Great info, thanks Brian
    – codeulike
    Commented Jun 26, 2019 at 9:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .